Support

Please look again at the screenshot you sent me. The URL displays tmpl=dbzcbafag. The key dbzcbafag is not in your  “List of allowed tmpl= keywords”. Therefore it will be blocked. However, don't add it just yet!

Are you absolutely sure this is a legitimate link? To me, it looks like someone is doing a fuzzing attack on your site, trying to find vulnerabilities in installed components. There's no such thing as tmpl=dbzcbafag in Joomla and this is the first time I see it in AcyMailing either. Double check that the Target URL you see corresponds to the link in the email.

I do not think that what you have here is a problem in Admin Tools. I think it's a legitimate attack that Admin Tools blocked. Here are some data points that make me think it's not a legitimate link:

• There is no mention of  tmpl=dbzcbafag in AcyMailing's code. There is tmpl=component in the acym_noTemplate() function it uses to create links meant to be presented without the site's template.
• If the past 14 years have taught me one thing is that when two popular products often used together, like Admin Tools and AcyMailing, become incompatible it takes 6 to 36 hours for their developers to hear about it and the reports come in bucketloads. It's been a week since the last release of AcyMailing. Nobody has reported this problem. The likelihood that you are the canary in the mine is very small.
• What AcyMailing tries to do – display the email without the site's template around it – is something that can be done two ways since Joomla! 1.0. You either use tmpl=component (recommended) or format=raw (special cases only). It's highly unlikely that AcyMailing was correctly using tmpl=component for 11 years and suddenly decided to do something dangerous and pointless. It's not like them.
• Even when misguided developers use a custom tmpl keyword, even though it's never necessary in Joomla, they use something which is somewhat human readable, not an inscrutable jumble of characters like dbzcbafag. Developers don't like undermining their own debugging efforts.
• The string dbzcbafag is simply someone trying to type "random" characters with their left hand on the keyboard.